Identifying Which Linux System Library Contains a Function

Identifying which Linux system library contains a function

Build a simple testcase in C, compile it and run 'ldd -r' on it to check what libs are loaded. If you don't get lstat() in C then you have a problem on your dev env. Or this env dates back before the age of symlinks :-)

How to determine in which .SO library is given C function?

This is not a sure fire way, but it can help in many cases.

Basically, you can usually find the library name at the bottom of the man page.

Eg, man XCreateWindow says libX11 on the last line. Then you look for libX11.so and use nm or readelf to see all exported functions.

Another example, man XShm says libXext at the bottom. And so on.

UPDATE

If the function is in section (2) of the man pages, it's a system call (see man man) and is provided by glibc, which would be libc-2.??.so.

Lastly (thanks Basile), if the function does not mention the library, it is also most likely provided by glibc.

DISCLAIMER: Again this is not a 100% accurate method -- but it should help in most cases.

Checking existence of a function in a library in linux

You should be able to use nm (might require the --demangle parameter) to get a list of everything being inside the library, then use grep to filter the results, e.g. look for \d T functionname\( or something like that.

Linux C program: How to find the library to which a function belongs

At runtime, you can use gdb for this:

(terminal 1)$ ./a
pid is  16614
address of printf is 0x400450

(terminal 2)$ gdb -p 16614
(...)
Attaching to process 16614
(...)
0x00000000004005a4 in main ()
(gdb)

(gdb) info sym printf
printf in section .text of /lib/x86_64-linux-gnu/libc.so.6

If you don't want to interrupt your program or are reluctant to use gdb, you may also ask ld.so to output some debugging info:

(terminal 1)$ LD_DEBUG=bindings LD_DEBUG_OUTPUT=syms ./a
pid is  17180
address of printf is 0x400450

(terminal 2)$ fgrep printf syms.17180
    17180:  binding file ./a [0] to /lib/x86_64-linux-gnu/libc.so.6 [0]: normal symbol `printf' [GLIBC_2.2.5]

how to view the functions and contents of a library

In general, you cannot see the source code of functions of a library (e.g. some libfoo.a or libfoo.so.* Linux files) compiled from C source code.

You should ask for the documentation of that library. If it is developed in house, you may need to discuss with colleagues.

I do like open source libraries like GNU libc or GTK. Because you are allowed to download their source code and study it.

Be aware of code obfuscation techniques and of Rice's theorem. Decompilation of binary libraries is legally forbidden in some countries.

But a lot of libraries are not open source.

On Linux, tools like objdump(1) or readelf(1) could be helpful.

Notice that some libraries (e.g. GNU lightning) are generating new functions and machine code at runtime. Hence the notion of function might be not as easy as you think.

On Linux, programs like my manydl.c or Bismon, or RefPerSys, or SBCL, are generating code at runtime: for manydl.c and Bismon it generates C code and dlopen(3) it after having compiled it as a plugin.

Jacques Pitrat's book Artificial Beings: the conscience of a conscious machine ISBN 978-1-84821-101-8 explains the interest of generating code at runtime. A relevant concept is partial evaluation.

Finding where Linux functions are defined

Using manpages

For basic C functions, the manpages should work.

man 2 read
man 3 printf

Section 2 is for system calls (direct to the kernel), and section 3 is for standard C library calls. You can generally omit the section, and man will figure out what you need on its own.

Note that you may need to take extra steps to get development-related manpages on your system. For example, on my Debian system, I had to do apt-get install manpages-dev glibc-doc.

Using library-specific references

For non-basic C functions, you should check the documentation of the library you're using (e.g., GNU's docs for libstdc++, doc.qt.io for Qt, library.gnome.org for GNOME projects like GTK, and so on).

Using the web

linux.die.net is a good online mirror of web pages.

LSB Navigator (as described in this answer) looks cool. I did not know about that.

Using grep

Sometimes it's just easiest to search /usr/include yourself. grep works for this, but ack is much better. For example, if I'm trying to find the header that contains getRootLogger:

cd /usr/include
# Debian calls 'ack' ack-grep.  Your system may differ.
# Add \b before and after to only match a complete word.
ack-grep '\bgetRootLogger\b'

ack will return a nicely formatted and colorized list of matches.

You can wrap this up in a function and put it in your .bashrc file (or equivalent) for easy use:

function findheaderfor() {
  ack-grep \\b$1\\b /usr/include /usr/local/include
}

---

Related Topics